DevGrail
All releases

v0.4.17

Signedpublished August 25, 2026

What changed

Added

  • The uninstaller now tells you what it is about to destroy. Every run opens with an inventory of this host — workspaces and whether they are running, workspace volumes by name, the database and certificate volumes, images, the files on disk, and how many backup archives are in /opt/devgrail/backups — with each line marked as destroyed or kept by the options you passed. The confirmation questions quote those numbers too, so "delete ALL DevGrail data" names how much data that actually is.
  • uninstall.sh --dry-run prints that report and stops, having changed nothing. It combines with the other options, so --nuke --dry-run reports a --nuke without performing any of it, including whether the Docker daemon settings the installer added are still ones it recognises as its own — it leaves anything you have since changed alone, and now says so in advance. --dry-run needs no terminal, so it works piped from curl.
  • A --remove-docker run now counts the containers and volumes on the host that are not DevGrail's before asking, since that option deletes those too.

Changed

  • Uninstalling without --purge no longer deletes your workspaces. A plain uninstall.sh now stops the workspace containers and leaves them on the host, together with the workspace image they run on — so everything in a workspace's own filesystem survives, not only what is in its volume, and re-running install.sh brings back the same workspaces instead of empty replacements. Only the Compose stack and the per-workspace networks are torn down, and both are recreated automatically. --purge still deletes everything, and now names the workspaces it is about to remove before it asks.

Fixed

  • An unattended uninstall.sh could abort instead of proceeding. It decided whether it had a terminal by checking that /dev/tty exists, which is true in places it cannot actually be opened — a detached service unit, a container started without a terminal, some CI runners. There it would try to ask a question, fail to read the answer, and treat that as "no". It now tests the same way install.sh does, by opening it.

Container images

devgrail-container
registry build 24
amd64742 MB
sha256:4657a309f66b799f8da65119896ed7953bbb700f0a9f8ef974cf0d45740ed0cf
Download
arm64612 MB
sha256:016f34061e0dabe08d72b8017ca02322e2b1f4e51f6d50ad04ff3b56d33ac283
Download
devgrail-server
registry build 28
amd6445 MB
sha256:25a92858b05f3697ffc80bfb84abffd6cc9e7b8e521aa6ba910aa6cfca0b393e
Download
arm6444 MB
sha256:cc6a151799434ac474dcd86bb13f550f50c58820deb880f71bbb1ee6d37cd726
Download

Installer files

docker-compose.yml16 KBsha256:25d99bfe1eb947d9f3277067aa9fa776fb3da3b8896e5fcb8737a73e2582dc31
install.sh132 KBsha256:57a946382d304d2a1deb30cc7cf9ceb760f96bf78e190d7e7e13119518d397ac
traefik-dynamic-http.yml5 KBsha256:e344c8efd13c7d84996e2ebfbc75dcee2d995d8538c8a245c89c0e44fad0089b
traefik-dynamic.yml6 KBsha256:d18fa561b8eb7d53b015284e0246b2d05953bf281b65269c1fae3d6883530db6
uninstall.sh49 KBsha256:9cab2f704164ae0f39b615a8dfba6bd7213d0eba4b2b55c195dfb967ed58bda6

Signature

ecdsa-p256-sha256key f1f1eaf642454d65

One signature covers every artifact above. It is made off this host, and neither this site nor the registry behind it can check it — that is the point, and it is why verifying it catches things a checksum from the same server cannot. How to verify it.

Verify devgrail-container (amd64)
curl -fsSL https://web-dev.trixibot.com/api/registry/releases/v0.4.17 -o release.json

# -j, not -r: -r appends a newline the signer never saw, and the check fails.
jq -j '.signature.payload'   release.json > payload
jq -r '.signature.signature' release.json | base64 -d > payload.sig

openssl dgst -sha256 -verify devgrail-release.pem -signature payload.sig payload
# -> Verified OK

# The payload must name this release, so an older signed one cannot be replayed.
head -2 payload

# ...and it must name this exact file. -qxF: whole line, literal.
grep -qxF 'image devgrail-container 24 amd64 4657a309f66b799f8da65119896ed7953bbb700f0a9f8ef974cf0d45740ed0cf' payload && echo "digest is covered by the signature"
The signed payload — shown for reading, not for verifying

Copy this from the manifest with jq -j, never from this page: the signature covers exact bytes, and rendering here drops the trailing newline the signer included.

devgrail-release-signature-v1
release v0.4.17
asset docker-compose.yml 24 25d99bfe1eb947d9f3277067aa9fa776fb3da3b8896e5fcb8737a73e2582dc31
asset install.sh 24 57a946382d304d2a1deb30cc7cf9ceb760f96bf78e190d7e7e13119518d397ac
asset traefik-dynamic-http.yml 23 e344c8efd13c7d84996e2ebfbc75dcee2d995d8538c8a245c89c0e44fad0089b
asset traefik-dynamic.yml 24 d18fa561b8eb7d53b015284e0246b2d05953bf281b65269c1fae3d6883530db6
asset uninstall.sh 24 9cab2f704164ae0f39b615a8dfba6bd7213d0eba4b2b55c195dfb967ed58bda6
image devgrail-container 24 amd64 4657a309f66b799f8da65119896ed7953bbb700f0a9f8ef974cf0d45740ed0cf
image devgrail-container 24 arm64 016f34061e0dabe08d72b8017ca02322e2b1f4e51f6d50ad04ff3b56d33ac283
image devgrail-server 28 amd64 25a92858b05f3697ffc80bfb84abffd6cc9e7b8e521aa6ba910aa6cfca0b393e
image devgrail-server 28 arm64 cc6a151799434ac474dcd86bb13f550f50c58820deb880f71bbb1ee6d37cd726